Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Please Help! BSOD


  • Please log in to reply
2 replies to this topic

#1 Vsam

Vsam

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 28 April 2014 - 08:25 PM

I keep getting a bsod with the error <bad_pool_caller_>          
I got a dump file and I posted it below. If anyone can read this and tell me what I need to fix. It'd be greatly appreciated :D
 
 
Microsoft ® Windows Debugger Version 6.3.9600.17029 AMD64
Copyright © Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [C:\Windows\Minidump\042814-25843-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
 
 
************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.16452.amd64fre.winblue_gdr.131030-1505
Machine Name:
Kernel base = 0xfffff802`0fc18000 PsLoadedModuleList = 0xfffff802`0fedc990
Debug session time: Mon Apr 28 19:02:17.324 2014 (UTC - 4:00)
System Uptime: 0 days 19:31:41.125
Loading Kernel Symbols
...............................................................
................................................................
................................................................
 
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck C2, {7, 1205, d, ffffe000111ecb68}
 
*** WARNING: Unable to verify timestamp for klwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for klwfp.sys
*** WARNING: Unable to verify timestamp for kneps.sys
*** ERROR: Module load completed but symbols could not be loaded for kneps.sys
GetPointerFromAddress: unable to read from fffff8020ff65150
GetUlongFromAddress: unable to read from fffff8020ff65208
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string'+797c )
 
Followup: MachineOwner
---------
 
 
************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001205, (reserved)
Arg3: 000000000000000d, Memory contents of the pool block
Arg4: ffffe000111ecb68, Address of the block of pool being deallocated
 
Debugging Details:
------------------
 
 
POOL_ADDRESS:  ffffe000111ecb68 Nonpaged pool
 
FREED_POOL_TAG:  NDnd
 
BUGCHECK_STR:  0xc2_7_NDnd
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
 
PROCESS_NAME:  System
 
CURRENT_IRQL:  2
 
ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre
 
LAST_CONTROL_TRANSFER:  from fffff8020feaa3ca to fffff8020fd65ca0
 
STACK_TEXT:  
ffffd000`22c28008 fffff802`0feaa3ca : 00000000`000000c2 00000000`00000007 00000000`00001205 00000000`0000000d : nt!KeBugCheckEx
ffffd000`22c28010 fffff800`00fadf67 : ffffe000`1410c230 ffffe000`008fc940 ffffe000`1880a001 fffff800`01b8d646 : nt!ExFreePoolWithTag+0x10fa
ffffd000`22c280e0 fffff800`01a11ee8 : ffffe000`051c5202 ffffe000`0d3570b0 00000000`00000001 fffff800`01b8e1c5 : NETIO! ?? ::FNODOBFM::`string'+0x797c
ffffd000`22c28130 fffff800`00f7c501 : ffffe000`1880a030 00000000`00000001 00000000`00000000 00000000`00000000 : tcpip!FlpReturnNetBufferListChain+0xd2b08
ffffd000`22c28180 fffff800`00f793e7 : ffffe000`008fc940 00000000`00000000 00000000`00000000 ffffe000`1880a030 : NETIO!NetioDereferenceNetBufferList+0xb1
ffffd000`22c281f0 fffff800`0194391b : 00000000`00000011 fffff800`01ace100 00000000`00000000 00000000`00000000 : NETIO!NetioDereferenceNetBufferListChain+0x2a7
ffffd000`22c282b0 fffff800`0194081a : 00000000`0402a8c0 ffffe000`008fc940 ffffe000`024cd000 00000000`00000000 : tcpip!IppReceiveHeaderBatch+0x55b
ffffd000`22c283e0 fffff800`01a73e20 : ffffe000`113a0f00 00000000`00000000 ffffe000`02500901 fffff800`02730700 : tcpip!IppFlcReceivePacketsCore+0x68a
ffffd000`22c28760 fffff800`01b806d5 : ffffe000`170f4202 ffffe000`010dc010 ffffd000`22c28a99 ffffd000`22c23000 : tcpip!IppInspectInjectReceive+0x148
ffffd000`22c287c0 fffff802`0fcd03f9 : ffffe000`0ad4a000 00000000`00000000 ffffe000`051c5210 ffffe000`051c5210 : fwpkclnt!FwppInjectionStackCallout+0xe5
ffffd000`22c28850 fffff800`01b916b6 : fffff800`01b805f0 ffffd000`22c28a20 00000000`00000010 00000000`00000001 : nt!KeExpandKernelStackAndCalloutInternal+0xe9
ffffd000`22c289a0 fffff800`024f7037 : ffffe000`051c5210 ffffe000`0d357010 fffff800`02744500 ffffe000`0d357010 : fwpkclnt!FwpsInjectTransportReceiveAsync0+0x2ea
ffffd000`22c28ae0 ffffe000`051c5210 : ffffe000`0d357010 fffff800`02744500 ffffe000`0d357010 ffffd000`22c20002 : klwfp+0x5037
ffffd000`22c28ae8 ffffe000`0d357010 : fffff800`02744500 ffffe000`0d357010 ffffd000`22c20002 ffffffff`00000001 : 0xffffe000`051c5210
ffffd000`22c28af0 fffff800`02744500 : ffffe000`0d357010 ffffd000`22c20002 ffffffff`00000001 fffff800`00000004 : 0xffffe000`0d357010
ffffd000`22c28af8 ffffe000`0d357010 : ffffd000`22c20002 ffffffff`00000001 fffff800`00000004 fffff800`00000000 : kneps+0x22500
ffffd000`22c28b00 ffffd000`22c20002 : ffffffff`00000001 fffff800`00000004 fffff800`00000000 ffffe000`008fc940 : 0xffffe000`0d357010
ffffd000`22c28b08 ffffffff`00000001 : fffff800`00000004 fffff800`00000000 ffffe000`008fc940 fffff800`024f6e98 : 0xffffd000`22c20002
ffffd000`22c28b10 fffff800`00000004 : fffff800`00000000 ffffe000`008fc940 fffff800`024f6e98 ffffe000`0d357010 : 0xffffffff`00000001
ffffd000`22c28b18 fffff800`00000000 : ffffe000`008fc940 fffff800`024f6e98 ffffe000`0d357010 ffffe000`08187630 : CI!_guard_check_icall_fptr <PERF> (CI+0x4)
ffffd000`22c28b20 ffffe000`008fc940 : fffff800`024f6e98 ffffe000`0d357010 ffffe000`08187630 fffff800`02744540 : CI!_guard_check_icall_fptr <PERF> (CI+0x0)
ffffd000`22c28b28 fffff800`024f6e98 : ffffe000`0d357010 ffffe000`08187630 fffff800`02744540 fffff800`024f71f2 : 0xffffe000`008fc940
ffffd000`22c28b30 ffffe000`0d357010 : ffffe000`08187630 fffff800`02744540 fffff800`024f71f2 00000000`00000000 : klwfp+0x4e98
ffffd000`22c28b38 ffffe000`08187630 : fffff800`02744540 fffff800`024f71f2 00000000`00000000 ffffe000`0d357010 : 0xffffe000`0d357010
ffffd000`22c28b40 fffff800`02744540 : fffff800`024f71f2 00000000`00000000 ffffe000`0d357010 00000000`00000080 : 0xffffe000`08187630
ffffd000`22c28b48 fffff800`024f71f2 : 00000000`00000000 ffffe000`0d357010 00000000`00000080 ffffe000`08187630 : kneps+0x22540
ffffd000`22c28b50 00000000`00000000 : ffffe000`0d357010 00000000`00000080 ffffe000`08187630 ffffe000`0ad4c8f0 : klwfp+0x51f2
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
NETIO! ?? ::FNODOBFM::`string'+797c
fffff800`00fadf67 90              nop
 
SYMBOL_STACK_INDEX:  2
 
SYMBOL_NAME:  NETIO! ?? ::FNODOBFM::`string'+797c
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: NETIO
 
IMAGE_NAME:  NETIO.SYS
 
DEBUG_FLR_IMAGE_TIMESTAMP:  5215f7e4
 
IMAGE_VERSION:  6.3.9600.16384
 
BUCKET_ID_FUNC_OFFSET:  797c
 
FAILURE_BUCKET_ID:  0xc2_7_NDnd_NETIO!_??_::FNODOBFM::_string_
 
BUCKET_ID:  0xc2_7_NDnd_NETIO!_??_::FNODOBFM::_string_
 
ANALYSIS_SOURCE:  KM
 
FAILURE_ID_HASH_STRING:  km:0xc2_7_ndnd_netio!_??_::fnodobfm::_string_
 
FAILURE_ID_HASH:  {fc6e9aa1-b899-d40c-eb82-38a4130ba536}
 
Followup: MachineOwner
---------

Edited by Vsam, 28 April 2014 - 08:28 PM.


BC AdBot (Login to Remove)

 


#2 scotty_ncc1701

scotty_ncc1701

  • Members
  • 520 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:31 PM

Posted 28 April 2014 - 09:32 PM

Just found this site, so I don't know how  reliable it is, but it's a starting point.

 

http://myfundoo-blog.blogspot.com/2011/12/stop-badpoolcaller-0x000000c2-error-in.html


Edited by scotty_ncc1701, 28 April 2014 - 09:32 PM.


#3 Anshad Edavana

Anshad Edavana

  • BC Advisor
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:10:01 PM

Posted 29 April 2014 - 02:47 AM

Hi

 

Two third part drivers - kneps.sys and klwfp.sys - are present on the call stack. These are part of "Kaspersky antivirus" so i would recommend uninstalling "Kaspersky" as a test. While uninstalling, make sure the option to save licence information is selected ( we can re-install it once the issue is resolved ).

 

kis2014_10014_07_en13-207916.png

 

 

Let us know how the system works without "kaspersky".

 

( for the time being, you can use built in "Windows Defender" to protect against malwares - http://windows.microsoft.com/en-in/windows/turn-windows-defender-on-off#turn-windows-defender-on-off=windows-7 )






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users